# Winlogbeat winlog.event\_data.AccessList process

**URL:** <https://discuss.elastic.co/t/winlogbeat-winlog-event-data-accesslist-process/278303>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [July 9, 2021, 6:49pm UTC](https://discuss.elastic.co/t/winlogbeat-winlog-event-data-accesslist-process/278303 "2021-07-09T18:49:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![MarceloSamoilenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcelosamoilenko/32/91439_2.png) [@MarceloSamoilenko](https://discuss.elastic.co/u/MarceloSamoilenko)\
**Post date:** [July 9, 2021, 6:49pm UTC](https://discuss.elastic.co/t/winlogbeat-winlog-event-data-accesslist-process/278303/1 "2021-07-09T18:49:08Z")

</div>

Hello everyone,

I want to have control of log events using Winlogbeat with parsing event with id 4663, winlog.event\_data.AccessMask's and winlog.event\_data.AccessList's

_winlog.event\_data.AccessMask: "0x10000"_  
_winlog.event\_data.AccessMask: "0x20"_  
_winlog.event\_data.AccessMask: "0x4"_  
_winlog.event\_data.AccessMask: "0x2"_  
_winlog.event\_data.AccessMask: "0x40"_

_winlog.event\_data.AccessList: "%%4417"_  
_winlog.event\_data.AccessList: "%%4418"_  
_winlog.event\_data.AccessList: "%%4420"_  
_winlog.event\_data.AccessList: "%%4422"_  
_winlog.event\_data.AccessList: "%%4424"_  
_winlog.event\_data.AccessList: "%%1537"_  
_winlog.event\_data.AccessList: "%%1539"_  
_winlog.event\_data.AccessList: "%%1540"_

winlog.event\_data.AccessMask \> ok  
winlog.event\_data.AccessList \> (# commented) is not working ☹

..from winlogbeat.yml

```auto
winlogbeat.event_logs:
  - name: Security
    event_id: 4663
    processors:
      - drop_event.when.not.or:
           - equals.winlog.event_id: 4663
           - equals.winlog.event_data.AccessMask: "0x10000"
           - equals.winlog.event_data.AccessMask: "0x20"
           - equals.winlog.event_data.AccessMask: "0x4"
           - equals.winlog.event_data.AccessMask: "0x2"
           - equals.winlog.event_data.AccessMask: "0x40"
# - equals.winlog.event_data.AccessList: "%%4417"
# - equals.winlog.event_data.AccessList: "%%4418"
# - equals.winlog.event_data.AccessList: "%%4420"
# - equals.winlog.event_data.AccessList: "%%4422"
# - equals.winlog.event_data.AccessList: "%%4424"
# - equals.winlog.event_data.AccessList: "%%1537"
# - equals.winlog.event_data.AccessList: "%%1539"
# - equals.winlog.event_data.AccessList: "%%1540"

```

Please, What am I doing wrong?

Thank you very much in advance!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 6, 2021, 8:49pm UTC](https://discuss.elastic.co/t/winlogbeat-winlog-event-data-accesslist-process/278303/2 "2021-08-06T20:49:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.